[manjaro-security] [arch-security] [ASA-201601-29] mbedtls: man-in-the-middle
Remi Gacogne
rgacogne at archlinux.org
Mon Jan 25 23:01:12 CET 2016
Arch Linux Security Advisory ASA-201601-29
==========================================
Severity: Medium
Date : 2016-01-25
CVE-ID : CVE-2015-7575
Package : mbedtls
Type : man-in-the-middle
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
Summary
=======
The package mbedtls before version 2.2.1-1 is vulnerable to
man-in-the-middle.
Resolution
==========
Upgrade to 2.2.1-1.
# pacman -Syu "mbedtls>=2.2.1-1"
The problem has been fixed upstream in version 2.2.1.
Workaround
==========
None.
Description
===========
mbedTLS before 2.2.1 is vulnerable to the SLOTH attack, breaking MD5
signatures potentially used during TLS 1.2 handshakes to impersonate a
TLS server.
Impact
======
A remote attacker might be able to impersonate a TLS server, acting as a
man-in-the-middle.
References
==========
https://bugs.archlinux.org/task/47783
https://access.redhat.com/security/cve/CVE-2015-7575
http://www.mitls.org/pages/attacks/SLOTH
https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <http://lists.manjaro.org/pipermail/manjaro-security/attachments/20160125/b48092a1/attachment.pgp>
More information about the manjaro-security
mailing list